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Complex  systems  will,  inevitably,  experience  failures.  The  cause  of  these  failures  or  mishaps  may  be 
labeled  ‘operator  error,’  but  often  they  are  actually  caused  by  the  confluence  of  technological,  situational, 
individual,  and  organizational  factors.  Several  models  and  theories  of  human  error  have  been  proposed 
over  the  years  and  are  reviewed  in  this  paper.  The  authors  propose  another  model,  the  Dynamic  Model  of 
Situated  Cognition  (DMSC),  to  explain  how  complex  systems  fail.  Miller  and  Shattuck  (2004)  developed 
the  DMSC  in  an  effort  to  link  technological  aspects  of  a  system  to  the  perceptual  and  cognitive  aspects  of 
that  system.  They  illustrated  the  model  by  applying  it  to  the  USS  Stark  incident  and  to  a  military  command 
and  control  simulation  (Shattuck  and  Miller,  2004).  The  model  also  appears  to  have  utility  as  a 
retrospective  explanatory  tool  to  identify  when  and  where  things  went  wrong.  In  this  paper,  the  authors 
describe  the  DMSC  as  it  relates  to  the  analysis  of  error  in  complex  systems  and  apply  it  to  the  February 
2001  mishap  in  which  the  U.S.  Navy  submarine  USS  Greeneville  collided  with  the  Japanese  motor  vessel 
Ehime  Maru  off  the  coast  of  Oahu,  Hawaii. 


INTRODUCTION 

Complex  cognitive  systems  will,  inevitably, 
experience  failures.  The  proximate  cause  of  these  failures  or 
mishaps  are  often  labeled  ‘operator  error,’  but  more  often  than 
not  they  are  caused  by  the  confluence  of  technological, 
situational,  individual,  and  organizational  factors.  Reason 
(1990;  1997)  argues  that  complex  systems  have  a  series  of 
defenses  which  are  designed  to  prevent  accidents  from 
occurring.  Holes  in  these  defenses  are  created  by  latent  or 
active  failures  which  set  the  conditions  for  a  trajectory  that  can 
lead  to  mishaps.  Other  researchers  have  examined  error  in 
complex  systems  and  have  developed  their  own  models  of 
how  and  why  accidents  occur  (Senders  &  Moray,  1991; 
Woods,  Johannesen,  Cook,  &  Sarter,  1994;  Doemer,  1996; 
Snook,  2000;  Strauch,  2002;  Dekker,  2002). 

Miller  and  Shattuck  (2004)  developed  a  Dynamic 
Model  of  Situated  Cognition  linking  the  technological  aspects 
of  a  complex  system  to  the  perceptual  and  cognitive  aspects  of 
the  system.  They  illustrated  the  model  by  applying  it  to  a 
military  command  and  control  simulation.  Data  and 
information  flowed  (and  sometimes  were  prevented  from 
flowing)  through  the  model  resulting  in  decision  makers’ 
understanding  of  the  situation.  This  model  is  not  only  useful 
for  examining  the  flow  of  data  and  information  as  events 
unfold  in  a  complex  system,  it  also  appears  to  have  utility  as  a 
retrospective  explanatory  mechanism  to  identify  when  and 
where  things  go  wrong.  This  paper  reviews  approaches  to 
explaining  human  error,  presents  further  details  on  the 
Dynamic  Model  of  Situated  Cognition,  and  demonstrates  how 
the  model  can  be  used  to  retrospectively  account  for  mishaps. 

Senders  and  Moray  (1991)  suggest  that  hardware 
failures  can  contribute  either  directly  or  indirectly  to  abnormal 
system  states  and  that  human  error  can  be  proximate  or 
remote.  Their  causal  network  for  error  analysis  includes  both 
technological  (hardware)  and  human  components  but  it  is  not 


clear  how  those  components  interact  with  one  another  as  an 
event  unfolds.  The  authors  propose  that  investigators 
construct  a  causal  chain  which  begins  at  the  point  of  failure 
and  proceeds  backward  in  time  to  events  that  might  have 
contributed  to  the  mishap. 

Strauch  (2002)  reviews  several  of  the  leading  theories 
of  error  in  complex  systems.  He  states  that  “operator  errors 
are  the  logical  consequences  of  antecedents  or  precursors  that 
had  been  present  in  the  systems  at  the  time  they  were 
committed”  (p.  16).  The  emphasis  on  system  antecedents  is  a 
relatively  recent  phenomenon  in  the  field  of  error 
investigation.  Antecedents  hidden  in  the  system  are  detected 
when  they  influence  an  operator’s  performance.  Investigators 
have  also  expanded  the  scope  of  their  analysis  by  broadening 
both  what  they  consider  to  be  the  system  and  what  they  deem 
to  be  the  relevant  window  of  time.  Strauch  lists  six  elements 
that  comprise  a  system  (after  Moray,  1994,  2000),  each  more 
removed  from  the  actual  failure  event  than  the  preceding 
element:  equipment;  individual  operator;  multi-operator  team; 
company  and  management;  regulator;  and,  social  and  cultural 
factors. 

Woods,  et  al.  (1994)  characterize  a  complex  system 
as  having  a  sharp  end,  where  operators  interact  with 
technology,  and  a  blunt  end,  which  includes  managers, 
designers,  and  administrators  who  are  spatially  and  temporally 
distant  from  the  operators.  They  list  fourteen  premises  of 
human  error.  Included  in  their  list  are  the  following: 

•  Erroneous  actions  and  assessments  are  the  start  of  the 
investigation,  not  the  end. 

•  Erroneous  actions  are  a  symptom,  not  a  cause. 

•  There  is  a  loose  coupling  between  process  and  outcome. 

•  Incidents  evolve  through  the  conjunction  of  several 
failures/factors. 

•  Some  of  the  contributing  factors  to  incidents  are  latent 
in  the  system. 
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•  Error  tolerance,  error  detection,  and  error  recovery  are 
as  important  as  error  detection. 

•  The  design  of  artifacts  affects  the  potential  for 
erroneous  actions  and  paths  toward  disaster. 

Reason  (1990;  1997)  describes  error  in  terms  of  a 
failure  in  a  system’s  defenses.  He  postulates  that  a  system 
may  have  multiple  defenses,  each  of  which  may  have  holes  in 
them  due  to  either  latent  or  active  failures.  If  the  holes  line  up, 
it  is  possible  for  an  error  trajectory  to  pass  through  the  system, 
which  will  result  in  an  accident  or  mishap,  hence  the  analogy 
of  a  ‘Swiss  cheese’  model.  Reason  describes  a  system  as 
having  three  levels  (the  person,  the  workplace,  and  the 
organization).  Causality  flows  from  the  organization  to  the 
person;  accident  investigations  typically  flow  from  the  person 
back  to  the  organization. 

Recent  work  by  Wiegmann  and  Shappell  (2003), 
based  on  Reason’s  theoretical  framework,  focuses  on  a 
methodology  for  conducting  aviation  accident  investigations. 
The  Human  Factors  Analysis  and  Classification  System 
(HFACS)  expands  on  Reason’s  work  by  offering  a  taxonomic 
approach  to  classifying  the  nature  of  the  holes  in  his  ‘Swiss 


cheese’  model.  HFACS  has  received  considerable  attention  in 
the  military  and  civil  aviation  communities  and  has  been 
recently  adopted  as  an  accident  investigation  tool  by  several  of 
these  US  and  international  communities. 

In  general,  the  human  error  models  described  above 
consider  systems  to  have  distal  and  proximate  elements. 

These  models  may  also  include  both  human  and  technological 
components.  Flaws  in  these  models  may  lie  dormant  or  go 
unnoticed  until  certain  activities  or  precipitating  events 
uncover  them.  These  models  do  not  necessarily  describe 
systems  in  a  dynamic  manner  and  they  do  not  address  how 
systems  are  designed  to  perform.  In  Figure  1,  the  Dynamic 
Model  of  Situated  Cognition  (Miller  and  Shattuck,  2004) 
describes  total  human  system  performance,  incorporating  the 
notion  that  this  process  is  dynamic,  with  feed-forward  and 
feedback  loops  operating  continuously.  The  authors  have 
previously  used  the  DMSC  to  illustrate  design  flaws  and  the 
flow  of  information  in  a  system.  In  this  paper,  the  authors 
argue  that  the  model  can  also  be  used  to  explain  how  mishaps 
occur. 


environment  decision  maker 


Figure  1.  A  Dynamic  Model  of  Situated  Cognition. 


TECHNOLOGICAL  PORTION  OF  THE  SYSTEM 

The  DMSC  is  applicable  to  virtually  any  domain  in 
which  technology  and  humans  combine  to  accomplish  a  stated 
goal.  The  authors,  however,  have  chosen  to  explain  and 
illustrate  the  model  in  a  military  command  and  control  (C2) 
setting.  The  large  oval  on  the  left  side  of  the  figure  (Oval  1) 


depicts  ground  truth,  i.e.,  everything  in  the  world.  Ground 
truth  is  dynamic  in  nature,  changing  with  spatial  and  temporal 
progression  although  it  may  be  captured  or  frozen  at  points  in 
time.  There  is  no  error  or  uncertainty  with  respect  to  Oval  1 . 
Simulations  allow  for  the  accurate  representation  of  ground 
truth.  In  the  real  world,  however,  it  is  understood  that  Oval  1 
cannot  be  measured  with  complete  precision  and  accuracy. 


The  blue  rectangles  and  red  diamonds  in  Oval  1  represent 
individual  data  elements  for  friendly  and  enemy  entities. 

While  are  other  things  are  present  in  the  world  (e.g., 
noncombatants,  weather,  terrain,  friendly  and  enemy  intent), 
they  have  been  excluded  from  the  figure  for  simplification. 

The  next  oval  (Oval  2)  shows  the  elements  detected 
by  the  technological  systems.  Note  that  this  oval  is  depicted 
as  a  subset  of  the  first  oval.  However,  it  is  not  apparent  what 
portions  of  ground  truth  are  being  detected  and  what  items 
remain  undetected.  Error  or  uncertainty  can  first  enter  the 
model  at  Oval  2,  taking  various  forms.  Oval  2  is  a  subset  of 
Oval  1  for  a  variety  of  reasons. 

•  Not  enough  sensors  available  to  cover  environment. 

•  Sensors  unable  to  detect  due  to  lack  of  sensitivity  or 
specificity. 

•  Enemy  activity  designed  to  deceive  (spoofing). 

•  Sensors  may  malfunction. 

As  in  subsequent  sections  of  the  model,  inaccuracy  or 
uncertainty  in  Oval  2  can  result  in  error  which  may  be 
propagated  throughout  the  rest  of  the  model. 

Oval  3  depicts  what  is  displayed  on  the  decision 
maker’s  workstation.  Again,  these  data  are  a  subset  of  what  is 
represented  in  Oval  2.  Users  are  able  to  tailor  their  displays  to 
suit  their  individual  preferences.  If  the  user  has  the  display 
settings  adjusted  on  the  C2  screens  such  that  information  is 
not  displayed,  it  is  possible  that  important,  perhaps  vital, 
information  may  be  hidden  or  concealed.  It  may  not  be 
obvious  to  the  user  which  data  have  been  excluded.  Oval  3 
represents  yet  another  entry  point  for  error  or  uncertainty  into 
the  model. 

HUMAN  PORTION  OF  THE  SYSTEM 

Three  distinct  lenses  are  depicted  in  Figure  1.  Each 
individual  enters  a  situation  with  a  unique  set  of  lenses.  In  a 
military  context,  the  lenses  may  be  thought  of  as  shaped  by  the 
following  categories:  individual  traits  or  characteristics,  states 
or  performance  characteristics  (system,  team  and  individual), 
experience  (societal,  cultural  and  individual),  and  doctrine  and 
rules  of  engagement  (macro  level  -  the  context  in  the  months 
preceding  the  incident;  micro  level  -  the  context  in  the  days 
and  hours  preceding  the  incident).  Together,  these  classes  of 
information  influence  what  is  perceived  by  the  user  or 
decision  maker  and  they  represent  potentially  significant 
sources  of  error. 

Oval  4  represents  all  the  data  actually  perceived  by 
the  decision  maker.  Perceived  data  in  Oval  4  are  a  subset  of 
the  data  available  in  the  environment,  the  sensor  array,  the 
configuration  of  the  local  C2  display,  and  are  based  on  the 
characteristics  of  the  lens.  In  addition,  information  in  Oval  4 
can  be  received  from  other  humans,  represented  by  the  three 
figures  between  Oval  3  and  Lens  A.  These  humans  can 
contribute  their  perceptions,  comprehensions  or  projections. 

Perceived  data  are  of  little  value  to  the  decision 
maker  until  they  are  processed.  The  same  lens  components 
that  directed  attention  and  led  to  perception  also  influence 
comprehension.  The  friendly  and  enemy  icons  in  Oval  5  have 
been  linked  and  reorganized,  suggesting  that  they  have  been 
processed,  representing  the  comprehension  of  the  data 


elements  that  were  perceived.  The  oval  is  embedded  in  an 
amorphous  shape,  suggesting  that  there  are  other  possible 
ways  the  data  could  be  linked  and  reorganized  that  would  lead 
to  alternative  mental  representations  of  the  data. 

The  final  oval  (Oval  6)  represents  the  projection  into 
the  future  or  the  prediction  of  the  user.  Alternate  views  of  the 
battlefield  within  the  amorphous  shape  but  outside  of  Oval  5 
do  not  contribute  to  or  influence  the  prediction  of  the  decision 
maker.  Note  that  the  amorphous  shape  that  surrounds  Oval  6 
is  larger  than  that  which  surrounds  Oval  5  and  contains  even 
more  alternatives.  This  representation  depicts  the  idea  that 
there  is  much  greater  uncertainty  associated  with  prediction. 

Thus  far,  the  DMSC  has  been  described  as  a 
relatively  linear  process  starting  in  Oval  1  and  progressing 
through  Oval  6  but  that  is  far  from  accurate.  There  are 
feedback  loops  to  previous  Ovals  and  Lenses  in  the  DMSC 
that  are  intrinsic  to  its  dynamic  nature.  To  illustrate  how 
feedback  loops  may  influence  the  information  flow  process,  a 
projection  (Oval  6)  could  lead  the  decision  maker  to  alter 
speed  or  trajectory  (thereby  changing  Oval  1),  modify  the 
sensor  coverage  (Oval  2)  or  a  local  C2  display  (Oval  3), 
influence  perception  of  data  (Oval  4),  or  influence 
comprehension  of  data  (Oval  5).  Moreover,  both  projection 
(Oval  6)  and  comprehension  (Oval  5)  can  shape  the  contents 
and  contours  of  the  decision  maker’s  lenses  (A,  B,  and  C). 
Error  may  be  inected  into  the  system  through  any  of  these 
feedback  loops. 

APPLICATION  OF  THE  MODEL 

To  demonstrate  the  utility  of  the  DMSC,  we  examine 
an  actual  submarine  command  and  control  mishap  on  the  USS 
Greeneville,  using  a  process  tracing  methodology  to  pinpoint 
where  and  when  the  errors  occurred,  leading  to  the  mishap. 
This  analysis  offers  an  example  of  how  the  DMSC  can  be  used 
to  determine  how  errors  enter  a  system  and  are  then 
propagated  through  it. 

On  February  9,  2001,  the  U.S.  Navy  submarine  USS 
Greeneville  collided  with  the  Japanese  motor  vessel  Ehime 
Maru  off  the  coast  of  Oahu,  Hawaii.  (See  Figure  2  for  an 
organizational  chart  of  the  personnel  directly  involved  in  the 
C2  process  and  in  this  incident.)  The  submarine  was 
demonstrating  an  emergency  surfacing  maneuver  for  civilian 
guests  onboard  for  a  seven-hour  distinguished  visitor  cruise. 

As  it  rose  to  the  surface,  the  submarine  struck  the  fishing 
vessel’s  aft  port  quarter,  causing  the  ship  to  sink  in  less  than 
10  minutes.  Of  the  35  Japanese  crew,  instructors,  and  students 
onboard  the  Ehime  Maru ,  26  were  rescued  while  nine  remain 
unaccounted  for,  presumed  dead  (Executive  Summary  of  USS 
Greeneville  collision,  retrieved  04/14/2005  from 
http://www.cpf.navy.mil/greeneville.html). 

For  the  purposes  of  the  DMSC  application,  the 
following  sources  of  error,  while  far  from  exhaustive,  will  be 
used: 

•  Submarine  is  behind  schedule. 

•  Equipment  failure. 

•  CO  is  overconfident;  influences  lenses  of  crew. 

•  FTOW  manually  overrides  and  enters  incorrect 
surface  contact  solution  data. 


Submarine  Behind  Schedule 

The  problems  started  when  the  submarine  fell  behind 
schedule  by  30  minutes  and  had  less  than  an  hour  to  get  to  a 
pre-designated  location.  At  this  point,  the  commanding 
officer  (CO)  of  the  USS  Greeneville  made  a  series  of  decisions 
and  issued  orders  that  created  an  artificial  sense  of  urgency  in 
crewmembers  in  the  control  room.  This  elevated  time 
pressure  affected  the  individual  lenses  (Lens  A,  B  and  C  on 
the  right  side  of  the  model)  of  the  crewmembers,  adversely 
impacting  their  ability  to  accurately  process  the  information 
residing  in  Oval  4  though  Oval  6  (perception,  comprehension, 
and  projection).  Error  enters  the  model  through  this  process. 

Commanding 

Officer 


Officer 
of  the  Deck 


Sonar  1  Fire  Control 

Technician  Technician  of  the  Watch 


One  of  the  decisions  made  by  the  CO  was  to  prepare 
to  come  to  periscope  depth.  Mandatory  procedures  for  a 
submarine  to  come  to  periscope  depth  (PD)  require  that  the 
Officer  of  the  Deck  (OOD)  hold  a  periscope  briefing  with 
watchstanders,  conduct  two  good  target  motion  analysis 
(TMA)  legs  of  about  three  minutes  on  each  surface  contact, 
provide  the  necessary  report  and  obtain  the  CO’s  permission 
to  proceed  to  PD.  These  procedures  were  known  to  all 
crewmen  and  were  part  of  their  lenses.  The  CO,  however, 
abbreviated  these  procedures  used  by  the  crew  to  maintain 
their  SA  during  the  PD  maneuver. 


Chief  of  the  Watch  Dive  Officer 
Of  the  Watch 


1  Control  Room 

I-  —  —  —  —  —  —  . 


Helmsman  Planesman 
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Figure  2.  Partial  organizational  chart  for  the  USS  Greeneville. 


The  CO’s  decision  not  only  compromised  the 
procedures,  it  generated  feedback  loops  to  other  portions  of 
the  system  which  virtually  assured  the  data  in  the  environment 
(Oval  1)  which  were  detected  by  the  sensors  (Oval  2)  were 
inaccurate  or  incomplete.  Hence,  the  data  displayed  on  the  C2 
workstations  (Oval  3)  were  also  inconsistent  with  Oval  1 ;  and 
the  perception,  comprehension,  and  projection  (Ovals  4,  5,  and 
6)  of  the  crewmembers  with  regard  to  the  surface  contacts 
were  formulated  based  on  erroneous  data. 

Equipment  Failure 

The  information  on  the  closing  rate  of  the  Ehime 
Maru  was  not  in  Oval  3  (data  available  on  the  C2  system) 
because  a  critical  display  system  was  not  working.  The 
Analog  Video  Signal  Display  Unit  (AVSDU),  located  in  the 
control  room  of  the  submarine  where  it  provides  a  remote 
display  of  sonar  data  used  for  surface  contact  analysis,  was 
inoperative.  Since  information  on  the  proximity  of  the  Ehime 
Maru  was  not  available  in  Oval  3  from  the  AVSDU,  it  could 
not  be  propagated  throughout  the  rest  of  the  model.  Hence, 
errors  may  arise  either  because  erroneous  data  propagate 
through  a  system  or  because  data  fail  to  propagate  through  a 
system. 

Overconfidence  of  CO 

There  were  three  surface  ships  in  the  vicinity  of  the 
submarine.  Data  on  two  of  the  surface  contacts,  including  the 
Ehime  Maru ,  resided  in  both  Oval  1  (ground  truth  or  data  in 


the  environment)  and  in  Oval  2  (data  detected  by  sensors)  of 
the  DMSC.  The  third  contact  was  only  in  Oval  1.  The  Ehime 
Maru  was  closing  on  the  USS  Greeneville  but  at  this  point  this 
information  only  was  available  in  Oval  1  and  Oval  2.  Prior  to 
the  CO’s  decision  to  surface,  the  sonar  technician  reported  a 
new  contact  to  the  control  team.  The  third  surface  contact  in 
Oval  1  had  just  been  detected  by  the  sensors  (Oval  2)  and  was 
now  displayed  on  the  sonar  technician’s  workstation  (Oval  3). 
Although  the  sonar  technician  had  announced  the  new  contact, 
this  information  either  did  not  pass  through  Lens  A  in  the 
model  or  was  skewed  as  it  passed  through.  The  result  was  that 
neither  the  CO  nor  the  OOD  perceived  (Oval  4)  the  situation 
properly;  they  did  not  recognize  that  the  sonar  report  was 
information  on  a  new  contact. 

The  CO  then  announced  to  Control  that  he  had  a 
good  feel  for  the  contact  picture  and  ordered  the  OOD  to 
proceed  to  PD  on  the  same  course.  The  OOD  was  not  given 
enough  time  to  develop  an  accurate  picture  of  the  surface 
contact  situation.  He  did  not  conduct  the  required  periscope 
brief  with  watchstanders,  missing  a  valuable  opportunity  to 
receive  and  critically  assess  important  contact  information 
from  the  sonar  tech.  He  was  deprived  of  input  from  both  the 
technological  agents  and  the  human  agents  in  the  system. 

Additionally,  other  crewmembers  were  not  given 
enough  time  to  do  their  jobs  properly.  Upon  hearing  the  sonar 
technician’s  report  of  the  new  contact,  the  FTOW  (fire  control 
technician  of  the  watch)  rushed  to  complete  his  analysis  of 
three  surface  contacts  prior  to  PD,  overlooking  an  updated 
4000  yard  closing  solution  on  one  of  the  ‘old’  contacts  (the  ill- 


fated  Ehime  Maru).  His  focus  was  entirely  on  a  ’new4  contact 
which  he  considered  to  be  the  primary  contact  of  interest.  The 
FTOW’s  lens  was  skewed  by  the  false  sense  of  urgency 
established  by  the  CO  which  could  very  well  have  narrowed 
the  FTOW’s  focus  of  attention.  Further,  when  the  FTOW 
heard  the  CO  say  he  had  a  good  feel  for  the  contact  picture,  he 
assumed  the  CO  was  referring  to  all  contacts,  including  the 
new  one.  This  provides  further  evidence  of  a  skewed  lens  on 
the  part  of  the  FTOW,  which  may  have  contributed  to  his 
decision  to  remain  silent,  failing  to  provide  the  CO  with 
corrective  information. 

The  CO’s  erroneous  perception  led  to  an  incorrect 
comprehension  (Oval  5)  of  the  situation  and  an  inaccurate 
projection  (Oval  6)  of  where  the  vessels  would  be  in  the 
future.  At  no  time  did  the  CO  discuss  the  surface  picture  with 
the  contact  management  team  to  verify  a  common 
understanding  of  the  surface  contacts  (Ovals  5  and  6, 
comprehension  and  projection).  His  own  SA  of  contacts  was 
based  on  two  brief  walk-throughs  of  the  sonar  room  and  a 
single  review  of  fire  control  displays.  He  was  overly 
confident,  pressed  for  time,  and  failed  to  properly  use  both  the 
technological  agents  and  the  human  agents  in  the  system  to 
build  his  understanding  of  the  surface  picture. 

The  decision  to  proceed  to  PD  represents  a  feedback 
loop  from  Oval  6  (projection)  to  Oval  1  (environment).  As  the 
submarine  ascended  to  PD,  the  contents  of  Oval  1  were 
changed  and  new  data  were  available  for  propagation  through 
the  model. 

While  at  PD,  the  CO  decided  to  interrupt  the  OOD’s 
periscope  search  and  performed  his  own  abbreviated  visual 
search  for  surface  contacts.  After  the  periscope  searches  by 
the  OOD  and  CO,  the  FTOW  cycled  back  through  his  surface 
contacts  and  correctly  calculated  a  dangerous  closing  solution 
for  one  of  the  contacts,  the  Ehime  Maru.  However,  the  OOD 
had  just  stated  he  had  seen  no  close  contacts  at  PD,  and  the 
CO  also  said  he  had  no  visual  contacts.  These 
pronouncements  so  skewed  the  lens  of  the  FTOW  that  he 
doubted  his  comprehension  (Oval  5)  of  the  situation  (that  there 
was  a  surface  contact  in  close  proximity  to  the  submarine). 

Actions  of  the  FTOW 

The  FTOW’s  erroneous  comprehension  generated  a 
decision  and  a  feedback  loop  from  Oval  5  (comprehension)  to 
Oval  3  (C2  workstation).  He  manually  overrode  the  correct 
solution  presented  by  his  workstation,  electronically  changing 
the  distance  of  the  surface  contact  ( Ehime  Maru)  from  4000  to 
9000  yards,  reflecting  the  distance  to  the  visual  horizon.  The 
FTOW  entered  this  erroneous  information  into  the  fire  control 
system.  The  result  of  this  action  created  an  impossible  speed 
solution  of  99  knots.  After  the  periscope  searches,  the  boat 
went  “emergency  deep,”  proceeded  to  400  feet,  and  conducted 
an  emergency  main  ballast  tank  blow.  The  ship  surfaced 
underneath  the  Ehime  Maru ,  causing  major  flooding  on  that 
ship  which  sunk  rapidly. 

CONCLUSION 


another  way  to  represent  how  decisions  and  events  can 
propagate  through  a  system.  We  believe  the  DMSC  shows 
promise  because  it  not  only  illustrates  the  linkages  between 
technology  and  human  agents  but  does  so  at  a  level  and  in  a 
manner  that  gives  investigators,  researchers,  and  designers  the 
ability  to  trace  data  through  the  system.  We  applied  the 
DMSC  by  reviewing  a  recent  submarine  mishap  involving  the 
USS  Greeneville.  Analysis  of  this  case  revealed  that  the 
technological  (e.g.,  sensor  coverage  and  workstation  display) 
and  perceptual/cognitive  (e.g.,  perception,  comprehension,  and 
projection)  systems,  along  with  the  unique  and  evolving 
contents  of  the  crewmembers’  lenses,  all  played  an  important 
role  in  the  unfolding  of  events.  Error  was  injected  at  various 
critical  stages  and  was  propagated  throughout  the  model  to  its 
ultimately  disastrous  ending. 

This  analysis,  along  with  previous  extensions  of  the 
model  to  the  USS  Stark  (FFG  31)  mishap  (Shattuck  &  Miller 
2004),  support  the  utility  of  an  approach  which  integrates 
technological  and  human  agents.  This  human  -  systems 
performance  approach  can  inform  system  designers  about 
weaknesses  or  vulnerabilities  in  a  current  or  planned  system 
and  give  them  data  they  need  to  make  modifications  to  the 
design,  which,  in  turn  will  result  in  better  systems  and  reduced 
risk  to  humans. 
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We  have  described  various  models  of  human  error 
and  proposed  the  Dynamic  Model  of  Situated  Cognition  as 


